MALICIOUS — 77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9.exe

MALICIOUS — 77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the execute family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9
SHA-1: 580ece933e9f609007b1c8605ef245f5627dc4f3
MD5: 58813057d929f6d79e69ffd26161fad1
imphash: 3fb6a9dab44411de426dea40f784f564
ssdeep: 98304:5oYyPPnNtxXxTCbJ7vOoq68ilpAvTaV/PBmWnHq0OCv5oF+RdarURFln7qoFiT7:5opN3XRCVjznpAveZhnfcSgYFooFi/x
TLSH: T15B61C07A022E3490E0FEA9A4BC4C2E8CD0E5B1799433AB554543DF0F680155BEEE746E
Submitted as: 77be91fc4ee0154ee4b6d0a48c596de2bffca40f1aebbf888b9ee2f3e09c89e9.exe
File type: pe · Size: 4045824 bytes
Verdict: malicious (99/100) · Family: execute

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (5 of 53 engines)

capa (capabilities): execute via PowerShell
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Hash: abuse.ch ThreatFox: known-malicious-hash
Emsisoft (Emergency Kit): Trojan.GenericKD.80945571
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7884) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80945571 (rule Trojan.GenericKD.80945571) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 4.2.1.0 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

54 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

40fda63e5bb45fc270fbf61f35a24b155b4d10978fb8d732b9c4b05d367f2987 - 40fda63e5bb45fc270fbf61f35a24b155b4d10978fb8d732b9c4b05d367f2987

Embedded URLs

https://aka.ms/nativeaot-compatibilit

Embedded domains

aka.ms
www.msftconnecttest.com
config.edge.skype.com
www.bing.com
dns.msftncsi.com
edge.microsoft.com
aps.prod.windows.com
watson.events.data.microsoft.com
ecs.office.com
g.live.com
fs.microsoft.com
self.events.data.microsoft.com
www.msftncsi.com
msedge.api.cdp.microsoft.com
geo.prod.do.dsp.mp.microsoft.com
geover.prod.do.dsp.mp.microsoft.com

Embedded IP addresses

4.2.1.0

More execute samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report